Provide Cloudflare (or other) preview on forked PRs

[rfay]

In today's contributor training we noted that Cloudflare previews aren't available on forked PRs. @chadcarlson and @gilzow mentioned that they have a technique that was used for forked PRs on Platform.sh docs.

[bmartinez287]

https://developers.cloudflare.com/pages/platform/known-issues
"Commits/PRs from forked repositories will not create a preview. Support for this will come in the future."
I wonder what worked around they used for it.

[gilzow]

It's a technique, but I'm not sure I would recommend it.

Bulk of the work is in this workflow: https://github.com/platformsh/platformsh-docs/blob/main/.github/workflows/build-from-fork.yaml

Essentially, for PRs from forks, we create a duplicate branch in the base repository from the fork's branch once the PR has been labeled as build-fork. We then push the duplicate to platform.sh and activate it as an environment. from then on, pushes to the PR are forced-pushed onto the cloned copy of the branch.

Once the PR is accepted, we have to handle deactivation and deletion of the cloned branch : https://github.com/platformsh/platformsh-docs/blob/main/.github/workflows/manage-environment.yaml#L72

It works but not without issues. Since we need to do things like add labels and comments, we have to run these workflows using the pull_request_target event instead of the pull_request event. This is potentially very dangerous. I'm not exactly happy with this setup as we have it but it's the best given our constraints.

[stasadev]

I used this technique to create Cloudflare Pages from fork PR without creating an extra PR:

1. Push the fork branch to upstream.
2. Go to https://dash.cloudflare.com/ > DDEV account > Compute (Workers) > Workers & Pages > ddev-com-front-end
   
3. Click view details on the deployment you want:
   
4. Copy alias, this is the URL you want:
   
5. Add that URL to the fork PR description.
6. If the fork PR pushes more changes, push them to the existing upstream branch, no need to update the URL.
7. After the fork PR is merged, delete the upstream branch.

[rfay]

Here's a set of suggestions from ChatGPT:

Safe Forked-PR Previews with Cloudflare Pages (Option A)

Problem

• Cloudflare Pages (when linked via the GitHub integration) does not create preview URLs for PRs that come from forks.
• This prevents outside contributors from seeing their changes live without a maintainer pushing a branch to upstream.

Solution

Use a two-stage GitHub Actions workflow:

1. Build job: runs for all PRs (including forks). No secrets are exposed. The static site is built and uploaded as an artifact.
2. Deploy job: downloads the artifact and publishes it to a separate Cloudflare Pages project using Direct Upload (Wrangler).
   This job is gated behind a GitHub Environment approval, so secrets are only used if a maintainer clicks “Approve”.

Why this is safe

• Isolation: Previews are deployed to a separate Pages project (e.g., ddev-com-prs) and subdomain. Production (ddev.com) is untouched.
• Least privilege: Use a Cloudflare API token with only Pages:Edit permissions. No DNS or account-wide access.
• Human gate: Deploy job requires manual approval before secrets are available.
• Fork-safe: Build runs without secrets, so external contributors can’t exfiltrate anything.

Setup Steps

1. Create a new Cloudflare Pages project (e.g., ddev-com-prs) without GitHub integration. It will only receive deployments via Wrangler Direct Upload.
2. Generate a Cloudflare API token:
   • Permission: Account → Cloudflare Pages:Edit only.
   • Scope: your account that owns the Pages projects.
3. Add secrets to your GitHub repo:
   • CLOUDFLARE_ACCOUNT_ID
   • CLOUDFLARE_API_TOKEN
4. Create a GitHub Environment named pages-preview:
   • Require reviewer approval before jobs can access its secrets.

Example Workflow

Save as .github/workflows/pr-preview.yml:

name: PR Preview to Cloudflare Pages (safe)

on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: read
  pull-requests: write   # to comment preview URL
  deployments: write

concurrency:
  group: pr-preview-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Build site
        run: |
          npm ci
          npm run build     # adjust if Hugo/Eleventy/etc.
      - uses: actions/upload-artifact@v4
        with:
          name: pr-site
          path: dist

  deploy:
    needs: build
    runs-on: ubuntu-latest
    environment: pages-preview   # requires maintainer approval
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: pr-site
          path: dist
      - name: Deploy to Cloudflare Pages (preview)
        id: deploy
        uses: cloudflare/wrangler-action@v3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          command: >
            pages deploy ./dist
            --project-name ddev-com-prs
            --branch pr-${{ github.event.number }}
            --commit-hash ${{ github.event.pull_request.head.sha }}
      - name: Comment URL
        if: always()
        run: |
          URL="${{ steps.deploy.outputs.pages-deployment-alias-url }}"
          gh pr comment ${{ github.event.number }} \
            --body "Preview ready: ${URL}"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

[rfay]

I would sure like to get something like this going before the contributor training on contributing a blog on Oct 8, 2025.